Changes

Jump to navigation Jump to search
254 bytes removed ,  15:04, 7 February 2019
m
no edit summary
Tickets are found in many encrypted files used by the Wii (e.g. [[WAD Files]] or [[Wiidisc|Wiidiscs]]s). They contain the encrypted [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] "title key, " and the Title ID of the data and are followed signed by a certificate from a [[certificate chain]](which usually is the same for all titles and stored somewhere on the NAND).So far I have only seen tickets with [http://en.wikipedia.org/wiki/RSA_numbers#RSA-2048 RSA-2048] signatureshave been seen. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4)
=== File structure === {| styleclass="border-collapse: collapse; padding: 0.2em 0.2em 0.2em 0.2em;wikitable"|- style="background-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" | '''! Start'''| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | '''! End! Length'''| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" | '''! Description'''|- style="background-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" 0x0000| 0x0000x0003| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 40x04| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" | Signature type (always 0x10001 for RSA-2048 (to be confirmed))|- style="background-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" 0x0004| 0x0050x0103| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 2560x100| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" | Signature by a certificate's key |-| 0x0104| 0x013F| 0x3C| Padding (Always 0 - everything after this field is covered by this the above signature)|- style="background-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" 0x0140| 0x017F| 0x40| 0x140Signature issuer| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 640x0180| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" 0x01BB| Signature issuer0x3C|ECDH data, used to generate one- style="backgroundtime key during install of console specific titles|-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" 0x01BC| 0x01BE| 0x03| 0x1bfUnused/Padding| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 0x01BF| 160x01CE| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" 0x10| Encrypted Title title key|- style="background| 0x01CF| 0x01CF| 0x01| Unknown|-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background0x01D0| 0x01D7| 0x08| ticket_id (used as IV for title key decryption of console specific titles) |-color: #ded;" | 0x01D8| 0x01DB| 0x04| 0x1dcConsole ID| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 0x01DC| 80x01E3| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" 0x08| Title ID / [http://en.wikipedia.org/wiki/Initialization_Vector Initialization Vector] (IV) used for AES-[http://en.wikipedia.org/wiki/Cipher_Block_Chaining#Cipher-block_chaining_.28CBC.29 CBC] encryption|- style| 0x01E4| 0x01E5| 0x02| Unknown, mostly 0xFFFF|-| 0x01E6| 0x01E7| 0x02| Ticket title version|-| 0x01E8| 0x01EB| 0x04| Permitted Titles Mask|-| 0x01EC| 0x01EF| 0x04| Permit mask. The current disc title is ANDed with the inverse of this mask to see if the result matches the Permitted Titles Mask.|-| 0x01F0| 0x01F0| 0x01| Title Export allowed using PRNG key (1 ="backgroundallowed, 0 = not allowed)|-color| 0x01F1| 0x01F1| 0x01| Common Key index (2 = [http: #ddd;//wiiubrew.org/wiki/WiiMode Wii U Wii mode], 1 = Korean Common key, 0 = "normal"Common key)| style="border: 1px solid #ccc; padding: -| 0x01F2| 0x0221| 0x30| Unknown. Is all 0 for non-VC, for VC, all 0except last byte is 1.2em; background|-color: #ded;" | 0x0222| 0x0261| 0x40| Content access permissions (one bit for each content)|-| 0x0262| 0x0263| 0x2220x02| style="border: 1px solid #ccc; padding: Padding (Always 0.2em; background)|-color: #ddd;" | 0x0264| 0x0267| 320x04| styleEnable time limit (1 ="border: 1px solid #ccc; padding: Enabled, 0.2em; background= Disabled)|-| 0x0268| 0x026B| 0x04| Time limit (Seconds)|-color: #edd;" | 0x026C| 0x02A3| 0x38| Always 0xFF 7 more time_limit structs as above (?{int enable, seconds})
|}
To get the title key decrypt the 16 bytes at offset 0x1dc 0x1bf with the Common Key using the master key and the Title ID (offset 0x1dc) as the initialization vector (the last 8 bytes of the IVshould be zero).
{{Languages|Ticket}}[[Category:File formats]]
91

edits

Navigation menu